Functions reference

Look up the endpoints, fields, execution modes, and status codes a function exposes.

All function endpoints are app-scoped and nested under an app slug. Lookup is by function slug, which is unique within an app rather than globally.

Interface support

Start from the task. A checkmark means that interface supports the workflow; an em dash means to choose another interface.

Workflow	JavaScript	Python	REST	Console	Guide
Execute a function and wait for the result	✓	✓	✓	✓	Execute a function
Execute a function and return immediately	✓	✓	✓	✓	Execute a function
Read an execution result by task ID	—	✓	✓	✓	Execute a function
List functions in an app	—	✓	✓	✓	Write a function
Read one function	—	✓	✓	✓	Write a function
Create a function	—	—	✓	✓	Create, run, and delete a function
Update a function or its code	—	—	✓	✓	Write a function
Delete a function	—	—	✓	✓	Security and limits
List version history	—	—	✓	✓	Versioning
Revert to an earlier version	—	—	✓	✓	Versioning
List invocations for one function	—	—	✓	✓	Logs and invocations
List invocations across the site	—	✓	✓	—	Logs and invocations
Read captured execution logs	—	—	✓	✓	Logs and invocations
Define cron schedules	—	—	✓	✓	Schedules
Filter event-triggered runs	—	—	✓	✓	Filter conditions

The JavaScript SDK has one function method, execute. For everything else, use the Python SDK, REST, or Console.

Endpoints

{app_slug} is the app slug and {slug} is the function slug.

Method	Path	Purpose
GET	/api/apps/{app_slug}/functions/	List functions in the app
POST	/api/apps/{app_slug}/functions/	Create a function
GET	/api/apps/{app_slug}/functions/{slug}/	Read one function
PATCH	/api/apps/{app_slug}/functions/{slug}/	Update selected fields
PUT	/api/apps/{app_slug}/functions/{slug}/	Replace the function
DELETE	/api/apps/{app_slug}/functions/{slug}/	Delete the function
POST GET PATCH PUT	/api/apps/{app_slug}/functions/{slug}/execute/	Execute the function
GET	/api/apps/{app_slug}/functions/{slug}/history/	List versions
POST	/api/apps/{app_slug}/functions/{slug}/revert/	Revert to a version
GET	/api/apps/{app_slug}/functions/{slug}/executions/	List invocations for this function
GET	/api/apps/{app_slug}/functions/{slug}/executions/{execution_id}/	Read one invocation, including the executed code
GET	/api/invocations/	List invocations across the site
GET	/api/invocations/{id}/	Read one invocation
GET	/api/invocations/{id}/result/	Read the task result for an invocation
GET	/api/invocations/by-task-id/{task_id}/	Read an invocation by its task ID (celery_task_id)
GET	/api/result/{task_id}/	Read a task result by its task ID

The execute action accepts four HTTP methods. The verb used reaches the function in params as __method__.

Every endpoint except execute and /api/result/{task_id}/ requires an organization owner or admin, or another cloud user with access to the site. The /api/invocations/ endpoints are scoped to the site, not to an app, and return invocations for every app in the site. /api/result/{task_id}/ is open to any signed-in caller, but only organization users see the traceback of a failed run. See Security and limits.

Function fields

Field	Type	Writable	Behavior
name	string, max 255	✓	Source of the generated slug
slug	string, max 255	—	Generated from name, de-duplicated with a numeric suffix, unique per app
app	app reference	—	Set from the URL
execution_mode	app · proxy	✓	No default; required on create
environment	string	—	Read-only. Always python
description	string	✓	Free text
code	string	✓	Python source for app mode
webhook_url	URL, max 500	✓	Required for proxy mode
auth_config	object	✓	Proxy authentication. Accepts bearer, api_key, basic, custom
headers	object	✓	Additional proxy request headers
config	object	✓	Scheduling options such as countdown (delay in seconds) and expires. Also carries timeout for proxy requests
params	object or null	✓	JSON Schema describing expected parameters
filter_conditions	string or null	✓	CEL expression, evaluated for event triggers only
is_active	boolean	✓	Defaults to true. Inactive functions return 404 from execute
async_mode	boolean	✓	Default execution style, overridable per request
is_public	boolean	✓	Defaults to false. Permits execution without authentication
tags	list	✓	Filterable by name, case-insensitive
version	integer	—	Incremented when a versioned field changes
total_versions	integer	—	Count of history records
schedules	list	✓	Cron schedules, written through the function body

id, created_at, updated_at, created_by, and modified_by are also read-only.

Fields that create a version

Changing any of these increments version and writes a history record: name, code, webhook_url, auth_config, headers, config, filter_conditions, execution_mode, is_active, async_mode, description.

A request that changes nothing in that list returns HTTP 200 with a body whose status is error, the message No changes detected, version unchanged, and code BAD_REQUEST. Treat 200 as "request handled", not as "function updated".

Revert restores code and filter_conditions only. Other versioned fields keep their current values, and the version counter advances rather than rewinding.

Execution modes

Mode	Requires	Result shape
app	app, code	result, stdout, stderr, logs, success
proxy	app, webhook_url	status_code, response, headers, success

Execute request

{
  "params": {"order_id": 123},
  "async": false
}

Query-string parameters are merged into params, with body values taking precedence on a key collision. When async is omitted, the function's async_mode applies.

A synchronous call returns 200 with the function's return value in data and the invocation record alongside it. An asynchronous call returns 202 with data set to null and an invocation record carrying celery_task_id, which is the handle for later result lookups.

Function signature

App-mode code must define main taking exactly three parameters:

main.py

def main(params, user_data, sdk_client):
    return {"ok": True}

Validation on write requires the literal text def main(params, user_data, sdk_client): to appear in the code. This is an exact string match, so type annotations, renamed parameters, or different spacing are rejected even when the resulting function would run. At execution time, main must additionally exist, be callable, and accept exactly three parameters.

Parameter	Carries
params	The caller's input, merged with query-string values, plus the keys below
user_data	The authenticated caller. For an unauthenticated call to a public function, it identifies the platform rather than a person
sdk_client	A TaruviBase SDK client authenticated as the caller, so the function reaches only what that caller could reach

params arrives with three keys added by the platform:

Key	Contents
__function__	This function's name, slug, and execution mode
request	HTTP metadata for the calling request
__method__	The HTTP verb used to call the function

Trigger types

Value	Origin	Filter conditions	Runs as
api	The execute endpoint	Not evaluated	The caller
schedule	A cron schedule	Not evaluated	The function's creator
event	An event subscription	Evaluated; a false result skips execution	The caller

Status and error codes

Status	Code	Cause
200	—	Synchronous execution completed, or a read succeeded
202	—	Asynchronous execution accepted
400	VALIDATION_ERROR	Invalid parameters, or code that fails compilation or the signature check
400	BAD_REQUEST	Execution failed inside the function, or an update changed nothing
403	FORBIDDEN	Authentication required for a non-public function, policy denied execution, or the caller lacks organization access to manage or read functions
404	NOT_FOUND	The app, function, or invocation does not exist, or the function is inactive

Limits

These are the values in force today. Functions is in preview, so treat them as current behavior rather than fixed guarantees, and avoid depending on an exact number where your code can handle a range.

Limit	Value	How to change it
Synchronous execution wait	900 seconds	—
Task retries	3	—
Proxy request timeout	30 seconds	Set config.timeout on the function
Log entries per execution	2,000	—
Log payload per execution	1 MiB	—
Single log message	10,000 characters	—
Functions per list page	20 default, 1,000 maximum	Send limit and offset
Invocations per list page	20 default, 1,000 maximum	Send page and page_size

An em dash means the platform sets the value and no request or function setting changes it.

Pace work inside your own code. A function that fans out requests, or one called in a tight loop, is bounded only by what its code does.

Invocation records persist for the life of the function; deleting the function deletes them.

Sandbox imports

App-mode code may import the modules below and nothing else. An import outside the list raises ImportError listing the permitted modules.

Group	Modules
Standard library	base64 bisect collections copy csv datetime decimal functools hashlib heapq io itertools json logging math random re statistics string time urllib uuid warnings zipfile
HTTP clients	httpx requests urllib3
Data and formats	numpy pandas tomli tomllib xml yaml
Dates and times	dateutil pytz
Text and markup	bs4 jinja2 markdown
Cryptography and tokens	cryptography jwt
Validation	jsonschema pydantic
AI and language models	anthropic cohere google langchain langchain_anthropic langchain_cohere langchain_community langchain_core langchain_google_genai langchain_openai langchain_text_splitters langgraph langsmith openai
Documents and images	docling docling_core fitz openpyxl pdfplumber PIL pypdf reportlab
Payments	stripe
TaruviBase	taruvi

Submodules come with their parent, so import urllib.parse and from google import genai are both permitted.

Database drivers (psycopg2, sqlalchemy), AWS SDKs (boto3, botocore), and traceback are not allowed. Reach your site's data and storage through sdk_client instead.

For what function code can reach once it is running, see Security and limits.

Related

• Functions overview
• Security and limits
• Troubleshooting